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Remarks 

In the Office Action dated November 28, 2005, Examiner rejected claims 1-20 
under 35 U.S.C, 102(e) as being anticipated by U.S. Pat. No. 6,735,702 (Yavatkar). 

In response to Examiner's Interview Summary dated February 14, 2006 
regarding the February 8, 2006 telephonic interview. Applicants' attorney does not completely 
agree with Examiner's characterization of the substance of the interview. Applicants' attorney 
did find the February 8, 2006 interview helpful. 

By this Amendment, Applicants' Attorney has amended independent claims 1 
and 9 to more particularly point out and distinctly claim what Applicants regard as their 
invention. Applicants' Attorney has not introduced new matter: Figure 7 illustrates collectors 
that are located at fixed points within a computer network; "the collectors interface with the 
forwarding infrastructure," (pg. 17, 11. 28-29); and, the "collector takes samples of statistics 
from the forwarding infrastructure," (pg. 18, 11. 1-2). Moreover, the controllers of 
Applicants' invention use either directed tracing or distribution correlation to trace attacks, 
(pg. 18, 11. 19-20). Neither of these methods employ mobile collectors to trace an attack, (pg. 
17 1. 18 - p. 18. 1. 32). 

With regard to amended claim 1, Yavatkar fails to teach, disclose, or suggest 
collecting statistics at collectors located at fixed points within a computer network from a 
plurality of measurement points located within routing and forwarding infrastructure of the 
computer network, the collectors interfacing with the forwarding infrastructure and taking 
samples of statistics from the forwarding infrastructure. Rather, Yavatkar discloses mobile 
agents, i.e., bloodhound agents, that gather information about a network attack: 
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The bloodhound agent is a mobile agent capable of executing on 
a node of a network, stopping execution, transporting itself to 
another node, and resuming execution. 
(Col. 3, 11. 55-57). 

To trace attack traffic, the bloodhound agent follows an iterative 
process of finding the port for the link on the node on which it 
operates which is accepting attack traffic, attempting to traverse 
that link (i.e. , to move to the node on the other side of the link) 
to a new node, and, once at the new node, again finding the port 
and link which are accepting attack traffic. 
(Col. 4, 11. 10-16). 

The collectors as claimed are not mobile: they are located at fixed points within 
the computer network. 

Yavatkar also discloses stationary agents, i.e. watchdog agents, positioned at 
selected network nodes. (Col. 3, 11.49-54). These watchdog agents monitor for traffic being 
received at the node on which it operates having characteristics of a network attack. (Col. 15, 
11. 7-9). In contrast, the collectors as claimed interface with the forwarding infrastructure of 
a computer network and take samples of statistics from the forwarding infrastructure. These 
statistics can be analyzed using such techniques as directed tracing or distribution correlation, 
(pg. 18,1. 19-20), to reconstruct the path taken by undesirable network traffic through the 
network from the source of the traffic. Neither of these methods employ mobile collectors to 
trace an attack, (pg. 1. 18 - p. 18. 1. 32). The techniques used by Yavatkar 's watchdog agents 
to detect a network attack do not reveal the path taken by undesirable network traffic through 
the network from the source of the traffic. (Col. 15, 1. 42 - Col. 16, 1. 21). Rather, once an 
attack is detected, a bloodhound agent is launched to trace the attack traffic to its source and 
analyze the paths taken by the attack traffic. (Col. 16, 11. 22-28). 
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With regard to claim 9 and for the reasons stated with regard to claim 1, 
Yavatkar fails to teach, disclose, or suggest collectors located at fixed points within the 
computer network for collecting statistics from a plurality of measurement points located 
within routing and forwarding infrastructure of the computer network, the collectors 
interfacing with the forwarding infrastructure and taking samples of statistics from the 
forwarding infrastructure. 

Claims 2-8 and 10-20 depend respectively from claims 1 and 9. For at least the 
reasons claims 1 and 9 are not anticipated by Yavatkar, claims 2-8 and 10-20 are not 
anticipated by Yavatkar. Claims 2-8 and 10-20 provide additional limitations beyond claims 
1 and 9 respectively and therefore are further not anticipated by Yavatkar. 

Applicants' Attorney submits that the claims are in a condition for allowance. 
Applicants' Attorney respectfully requests a notice to that effect. Applicants' Attorney also 
invites a telephone conference if the Examiner believes that it will advance the prosecution of 
this application. 
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Please charge any additional fees or credit any overpayment as a result of the 
filing of this paper to our Deposit Account No. 02-3978. A duplicate of this paper is enclosed 
for that purpose. 



Respectfully submitted, 
GERALD R. MALAN, ET AL. 
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